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Abstract 


Electrical distribution networks deliver a fundamental service to citizens. 
However, they are still highly vulnerable to natural hazards as well as to cyberat- 
tacks; therefore, additional commitment and investments are needed to foster 
their resilience. Toward that, this paper presents and proposes the use of a complex 
simulation model, called reconfiguration simulator (RecSIM), enabling to evaluate 
the effectiveness of resilience enhancement strategies for electric distribution net- 
works and the required resources to implement them. The focus is, in particular, on 
one specific attribute of resilience, namely, the readiness, i.e., the promptness and 
efficiency to recover the service functionality after a crisis event by managing and 
deploying the available resources rapidly and effectively. RecSIM allows estimating 
how and to what extent technological, topological, and management issues might 
improve electrical distribution networks’ functionality after the occurrence of 
accidental faults, accounting for interdependency issues and reconfiguration possi- 
bilities. The viability of implementing RecSIM on a real and large urban network is 
showcased in the paper with reference to the study case of the electrical distribution 
network (EDN) of Rome city. 


Keywords: electrical distribution network, resilience metrics, interdependence, 
outage recovery, vulnerability 


1. Introduction 


Electrical distribution network (EDN) delivers a fundamental service to citi- 
zens. Unfortunately they are still very vulnerable to natural hazards as well as to 
cyberattacks; both can affect electricity infrastructures, leading to power outages 
that might distress and delay the recovery of the impacted communities. In Europe, 
for example, adverse space weather, riverine floods, and earthquakes are recognized 
to be the prevalent hazards with high potential for disrupting the functions of the 
power grid. While high-voltage overhead transmission systems proved to be robust 
to earthquake hazard, earthquake-induced ground motion was recognized to cause 
inertial damage to electric distribution system, in particular, to heavy equipment, 
such as generators and transformers, and brittle items, such as ceramics, as well as 
to the building housing the substations; earthquake-induced ground failure and 
soil liquefaction were identified as one the main causes of damage to buried electric 
infrastructure components [1-3]. The time required for restoring power supply 
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following earthquakes was seen to range from few hours to months (being more 
frequently in the range from 1 to 4 days) depending on the repair capabilities (e.g., 
availability of man power, machinery, and spare material) and on the level of access 
to damaged facilities, possibly delayed by damages to the road network and/or by 
traffic congestion [1]. 

As far as adverse meteorological conditions are concerned, both the transmis- 
sion and distribution systems have been adversely affected by water bomb causing 
flooding, extreme snowfall or windstorm, and overheating [1]. As an example, high- 
voltage overhead lines might be subjected to failure due to ice sleeves on conductors 
during snowfalls; medium-voltage overhead lines might be subjected to failure due 
to fall of trees during windstorms, while overheating can cause catastrophic failure 
of underground cables [4, 5]. As an example, a clamorous case occurred in Auckland, 
New Zealand, in 1998 that involved the failure of four major underground cables due 
to overheating in the summer period. The failure of the underground cables kicked 
off a 5-week-long power outage across the central city and caused an estimated long- 
term economic impact equivalent to 0.1-0.3% New Zealand’ gross domestic product. 

From the few facts mentioned above, it is clear that additional commitment 
and investments would be worthwhile, if not needed, to foster the resilience of the 
EDNs. 

EDN resilience can be pursued steadily before, during, and after crisis situations 
by putting in place, in an integrated and balanced way, various actions aimed at 
increasing the robustness of the network components; the redundancy of the system; 
the resourcefulness, i.e., availability of resources (such as backup systems, human and 
material resources); and the readiness, i.e., the promptness and efficiency to recover 
the service functionality after a crisis event by managing and deploying the avail- 
able resources rapidly and effectively [6]. 

The works presented in this paper focuses on the resilience enhancement after 
crisis events, with particular emphasis on the factors that might increase the readiness. 
A further aspect examined by this work is the interdependency of EDNs with 
other critical infrastructures (CIs) and the implication that this has on the resilience 

of EDNs. EDNs are, in fact, essential for the functionality of other services such 

as water, telecommunications (tlc), roads, and other public services; on the other 
hand, EDNs depend on other critical infrastructures to deliver their service. In 
particular, EDNs are highly dependent on telecommunication that provides telecon- 
trol functionality to EDN, to such an extent that it is fair to assume that electrical 
and telecommunication networks do represent a unique, connected system of systems 
whose control, protection, and management should be performed as if it was a 
unique system. 

The paper is organized as follows. Section 2 presents relevant works related 
to existing methods for the resilience assessment of EDNs. Section 3 contains a 
description of the abstract model representing the topology and the constitutive 
elements of a large EDN. Section 4 identifies metrics for assessing the resilience of 
EDNs in terms of induced service impacts after different kinds of perturbations. 
Finally, Section 6 presents the implementation on the case study of Rome, Italy. 


2. Related work 


All definitions of resilience point to quantify a dynamic, adaptive property of a 
system (or of asystem of systems) expressing its ability to withstand perturbations 
and to recover, rapidly and effectively, to equilibrium condition as similar as pos- 
sible to that prior to perturbation [6-9]. When dealing with a technological system, 
the property of being “adaptive” inevitably leads to think of a number of factors 
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influencing the way the system might adapt other than its mere technological 
qualities (such as robustness, technological update of the components, etc.): these 
factors might include risk awareness and preparedness, to ordinary and emergency 
management capabilities, in general to management skills which must support 

the technological and the design quality of the network. Moreover, in the case of a 
system of systems, the resilience of a system also depends on the degree of resilience 
of the other systems whose services should be available for the recovery process and 
on the level of dependency that is between them. The nowadays emphasis on the 
resilience property of technological systems is a direct symptom of the increased 
awareness that networks’ functional dependency is one of the major issues that 
must be considered for improving CI protection and, as such, should be always 
appropriately considered when dealing with modeling and simulation activities of 
these systems. In particular, in Europe different resilience assessment and man- 
agement methods as well as new approaches and guidelines are proposed within 
interesting EU projects. The project SMR [10] proposes the guidelines and system 
dynamic modeling and simulation techniques to increase the resilience of cities, 
whereas the IMPROVER project [11] is more focused on CI. The project DARWIN 
[12] is focused on improving responses to expected and unexpected crises affecting 
critical societal structures during natural disasters (e.g., flooding, earthquakes) 
and man-made disasters (e.g., cyberattacks). To achieve this, DARWIN developed 
resilience management guidelines aimed at critical infrastructure managers, crisis 
and emergency response managers, service providers, first responders, and policy 
makers. Other interesting EU project results can be found in [13-15]. The main 
objective of these projects is the proposal of European Resilience Management 
Guideline (ERMG) frameworks to drive decision and policy makers, local govern- 
ments, and CI operators toward more resilient cities, societies, and infrastructures. 
ENEA has proposed CIPCast a framework for the resilience evaluation of a specific 
area that is compliant with the general guidelines proposed, for example, in [10]. 
CIPCast allows geographical information system, GIS-based risk assessment, 

and situational awareness through the continuous acquisition of different kinds 

of data from the field (e.g., weather forecast, infrastructure network status). 
Furthermore, CIPCast allows the assessment of the impacts and consequences of 
possible damage scenarios due to the prediction of natural hazards (such as heavy 
rain, flash floods, earthquakes) on the infrastructure networks and services and 
on the affected communities [17, 18]. The present work describes RecSIM [19], 

a specific module of CIPCast allowing the operational resilience assessment of 
electrical distribution grids. Indeed, there is an increasing demand for resilience 
framework assessment of power grids due to the fact that electrical power grids are 
recognized as critical lifelines that have to cope with different threads including 
extreme natural disasters and man-made attacks [20-25]. An extensive review of 
the existing metric system and evaluation methodologies, as well as a quantitative 
framework for power resilience evaluation, is presented in [9] where a classifica- 
tion and review of the different approaches proposed in literature are provided. 
Firstly, the proposed resilience evaluation approaches can be classified as qualitative 
methods and quantitative methods. Qualitative methods, thorough general picture 
of the system, provide guidelines for long-term energy policy making. In contrast, 
quantitative methods are often based on the quantification of system performances. 
The different methods can be further classified as simulation-based [20], analyt- 
ical-based [21], and methods based on statistical analysis and historic outage data 
[22]. According to this classification, RecSIM can be classified as a quantitative- 
simulation-based approach. In particular, RecSIM takes in input a damage scenario 
(i.e., the set of electrical grid components in failure), the resource available to face 
the crisis in terms of crews available, and the functioning status of the supervisory 
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control and data acquisition (SCADA) system and computes, in output, the power 
grid performance degradation in terms of the number of electrical users discon- 
nected times the minutes of disconnection. As metrics for characterizing, in a 
posteriori analysis, the resilience of the power grid is proposed in [24] in terms of 
outage duration, dependency and interdependency relations, and the existence of 
energy storages, and a mathematical model for their calculation is proposed and 
implemented with respect to test cases focusing on recent natural disasters hitting 
major countries. In [25] the authors adopted the definition of resilience provided by 
the NIAC [26] that considers robustness, redundancy, and rapid recovery as main 
resilience features and developed a sequential Monte Carlo-based model for assess- 
ing the impact of weather on EDN resilience and applied to transmission networks. 
Their model considers the impact of human response during weather emergencies 
through the characterization of the delay required for the restoration of damaged 
components (due to delay in the development of individual situation awareness in 
the affected control centers) and the delay in the information sharing between the 
system agents, namely, the transmission system operators (TSOs) and the repair 
crews. As a test case, the model was applied to the transmission network considering 
extreme wind events, and simulation results show the resilience of the network in terms 
of robustness, redundancy, and response measures. Other past works also included the 
effects of humans [27], and others consider the dependencies [28] on resilience. 

Similar to the approach proposed in [24] but considering the performance of 
EDN grids in complex urban contexts, RecSIM considers, simultaneously, the influ- 
ence of different key features that might affect the time required for restoring the 
functionality of EDNs after extreme events, namely, (1) the degree of dependency 
with other networks providing essential services; (2) the network topology; 

(3) the number of repair crews available; (4) the number and functionality of 
SCADA telecontrol devices; and (5) the conditions of the road network and of the 
traffic that might delay repair activities. 


3. Model description 


The proposed model aims at providing a model scheme, for the resilience 
assessment of EDNs, where all the abovementioned influencing factors could be 
appropriately considered. 

Having recognized that resilience mostly starts with a number of activities that 
are performed during the normal operational mode of the network such as ordinary 
management of assets, accurate prediction of the events, and subsequent efficacy in 
performing preparedness actions rather than only with a “last minute” emergency 
management; the idea was to realize advanced technological tools enabling CI 
operators to improve the operational procedures during the normal operation mode 
while ensuring a continuous monitoring of external scenarios to forecast possible 
perturbing events, accompanied to some ex ante prediction of the expected impact 
(in terms of both economic losses and reduction of citizen’s well-being) of possible 
emergency scenarios. With this objective in mind, ENEA has designed and realized 
a decision support system (DSS), called CIPCast, enabling to provide an opera- 
tional (24/7) forecast and risk analysis for the CI in a specific area [16]. CIPCast 
includes a map of CI elements which could be hit and disrupted by predicted 
natural events (flash floods, snow, landslides, flooding) or occurred events (such as 
earthquakes). CIPCast allows to estimate: 


e The physical impacts induced on EDNs following earthquakes [17] and flooding 
events 
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e The impact on service functionality associated with the predicted damage of CI 
elements (in terms of outage duration and geographical extension), also consid- 
ering possible perturbation cascades toward other networks and services [29, 30] 


e The consequences of the predicted outages, according to several metrics 
accounting for economic losses, reduction of citizen well-being, and impacts on 
the quality of service 


Within CIPCast, the RecSIM simulator represents the basic module for the 
resilience assessment of the EDN, as better described in Section 4. 

This section describes the theoretical model used to represent the topology of a 
large EDN within RecSIM. Figure 1 shows the main elements of the proposed model. 

EDNs are composed of a number of primary substations (PS). Each PS originates 
one (or more) medium-voltage (MV) line(s) ending into a further PS. The MV line 
is cut at a certain stage by a switch which decouples the line into two halves, each one 
supplied by one of the two overlooking PS. Each line connects a number of second- 
ary substations (SS) that, from the technological point of view, can be of one of the 
following types: “normal,” “remotely telecontrolled,” “automated,” and “frontier” 
substations (represented, respectively, as white, gray, orange, and purple nodes in 
Figure 1). The “automated” substations are key elements of the network as they are 
able to perform automatically the isolation and restoration procedures needed to 
react to failures happening to their downstream substations. “Frontier” substations 
can be used to restore a portion of a MV line from another MV line. The configura- 
tion of the network switches defines the running configuration of the network. The 
electrical operator attempts to operate the network in order to maintain as much as 
possible the grid in a so-called normal configuration which is chosen by the opera- 
tor as being able to allow the optimal operability of the grid (i.e., a good trade-off 
between robustness and efficiency, with the lowest possible electrical losses). 

During a crisis, the electrical operator can change the configuration of the net- 
work by operating the switches along the perturbed lines; the operator brings the 
network into a “contingency” configuration, in order to restore as fast as possible 
the electrical service to the final users. 

The model considers, furthermore, the dependencies between the electrical 
distribution grid supervisory control and data acquisition (SCADA) systems and 
the telecommunication components providing the telecontrol service. As shown in 
Figure 2, the telecontrolled substations use the communication service provided 
by the telecommunication (tlc) network components (i.e., the base transceiver 
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Figure 1. 
The elements considered in the electrical distribution grid model. 
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Figure 2. 
Electrical distribution grid SCADA system and tlc dependencies. 


Figure 3. 
Secondary substation (SS) finite state model. 


station—BTS hereafter—of the telecommunication network). In turn, BTS are sup- 
plied by the energy provided by the SS of the EDN, thus configuring a dependency 
loop (no energy on a specific BTS, no telecontrol functionality of this BTS in favor 
of other SS of the network). In this work, we suppose that BTS do not have power 
backup, i.e., we will simulate the worst possible case. This implies that if a certain 
BTS depends on a certain substation SS that is in a damaged (or disconnected) state, 
that specific BTS will immediately stop functioning. 

Each SS can be modeled as a finite state machine as shown in Figure 3. In normal 
conditions, the SS is in the initial “functioning” state. Starting from this state, the 
secondary substation (SS) can move into two different states: 


e Failure state: when a failure in the SS occurs, transition 1 is activated. The SS 
remains in this state for the expected failure duration; 


e Not functioning state: in case of a contingency, the protection devices of the grid 
will disconnect a number of secondary substations that will change their state 
from “functioning” to “not functioning.” For example, when a SS moves into the 
failure state, all SS on the same line move into their not functioning state. A SS 
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remains in this state waiting for restoration. The duration of the restoration can be 
in the range of few minutes (about 3-5 minutes) if the SS can be telecontrolled or 
much longer (50-55 minutes to few hours) depending on several factors (e.g., time 
required by emergency crews to reach the faulted substation and to restore it). 


4. Resilience metrics 


Let us assume to have an EDN characterized by its topology, with nodes N 
and links L corresponding to electrical stations and electrical lines, respectively. 
The function representing the functioning state for all the elements of the EDN is 
referred to as F: 


F(N,L,t) = OVt (1) 


if all elements N and L are in a functioning state and all telecontrol functionalities 
are active. Let us now introduce a perturbation function P that can change the state 
of one EDN element from the functioning state to one of the other possible states. In 
such a case 


P:F(N,L,t) > F (N,L,t) (2) 


where F'(N,L,t) > 0 for t € [0, T] and zero elsewhere. For the sake of simplicity, 
we will apply the perturbation P only to the electrical secondary station (referred 
to as SS). Time T represents the time when all elements have been repaired and the 
network comes back to its fully functional state F(N, L, t) = 0. A perturbation P, in 
principle, could affect one (or more) electrical station and bring it (or them) from 
the functioning state to the not functioning or the failure states. 

The damage of a SS consequent to the introduction of P produces a sequence of 
perturbations on the network. These consist in the disconnection of other nodes 
along the line due to instantaneous opening of protection switches. The damaged 
nodes are replaced by power generators (PGs) to ensure electrical continuity to the 
node’s customers. The damaged nodes will not be repaired in the time space of the 
simulation, but their function will be restored through the settlement of PGs. 

The disconnected nodes, in turn, are reconnected either through a telecontrol 
operation (if available) or by dispatching technical crews to provide manual recon- 
nection. All such interventions require specific times, which are considered when 
defining a restoration sequence of interventions. The impact of the perturbation P 
on the EDN is measured using a key performance indicator (KPI) that is currently 
used by the Italian Energy Authority to estimate the level of service continuity of 
an EDN. Such KPI is expressed as the number of disconnected customers ni of the 
i-th EDN node times the duration z; of its disconnection. Such a value is expressed 
in terms of kilominutes (i.e., 10° minutes). Thus, if the damage of the i-th SS of the 
network will result in the disconnection of m SS, each one for a time 7; (j = 1,m), the 
overall KPI outage metrics will be measured in terms of T; that is defined as follows: 


L; = 1,7; (3) 


For a given perturbation P, the integral over the simulated time span of Eq. (3) 
represents the perturbed functional state of the grid defined in Eq. (2): 


EF (N,L,t)dt =T; (4) 
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Tr, thus, represents the impact that the damage of an EDN element (the i-th 
node) can produce, by using an official KPI as a metric. The larger the value of r,, 
the weaker the capability of the network to withstand the perturbation in terms 
of impacts produced on the EDN customers. In general the value of r, depends on 
different factors (described in detail in Section 4) ranging from the topology of the 
network and the employed technologies to the efficiency of operator restoration 
procedures; therefore, it would not be inappropriate to correlate the value of r, with 
the inverse of the resilience concept R. In other terms 


R «I; (5) 


We can generalize the concept by checking the EDN behavior versus all possible 
perturbations. The overall operational network resilience will be thus associated 
with the inverse of the value of the integral of the distribution function of all the r, 
values (p(r)) resulting from the failure of each one of the N nodes of the EDN 
(normalized with respect to the total number of nodes N): 


Ra 1 _ Pew 
<T> EDDA 


(6) 


The higher the impact, the lower is the resulting operational resilience of the 
EDN network. 


5. The simulation scheme and the reconfiguration simulator (RecSIM) 


The RecSIM represents the basic module of the proposed framework for the 
resilience assessment of the EDN. RecSIM enables to carry on a “crisis game” 
consisting in the estimation of all r values resulting from the application of differ- 
ent perturbations. The simulator allows configuring different parameters allowing, 
in turn, the simulation of different electrical operational conditions (e.g., SCADA 
system not available, traffic jams, etc.) and the analysis of how the resilience indica- 
tor varies in these different operation conditions. 

Figure 4 shows the input of the RecSIM and its output (i.e., the consequence of a 
perturbation in terms of r;). RecSIM inputs are: 


¢ Network topology—expressed as the EDN graph and the perturbation P represented 
by the SS brought in the damaged state. 


e SCADA system—expressed in terms of the set Q of SS that can be remotely 
telecontrolled. 


Efficiency of SCADA system—expressed in terms of the functioning status of 
the BTS b; providing communication service to the EDN and in terms of tlc, 
the time needed to perform a remote operator action (using the EDN SCADA 
functionalities). 


Efficiency of restoration procedures—expressed in terms of the time needed by 
an emergency crew to reach a damaged SS (tr,), to perform a manual recon- 
nection action (m,), and to set in place a PG to feed the users of the damaged 
SS (or of other SS which will result to be isolated, thus needing a PG as they 
were damaged) (PG,). The input time values represent “mean” values as they 
have been provided by the electrical operator as resulting from its standard 
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Network topology 


Figure 4. 
The RecSIM input and output components. 


operation times. RecSIM performs simulations by using these values as mean 
values of a flat distribution from which time values to be used in the simulation 
are randomly extracted from the flat distribution. 


Technical resources—expressed in terms of the number C of technical crews 
available in the field. The number of available PGs is assumed to constitute an 
unlimited resource. Further development of the algorithm will consider the 
finiteness of available PGs. 


The output of RecSIM is represented by the value of the impact of the damage 
scenario (caused by the perturbation P and by its cascading effects) on the EDN, 
considering all the restoration actions performed (in series or in parallel, if several 
technical crews were simultaneously available): the substitution with a PG of a 
damaged node and, whenever the case, of an isolated node; the manual reconnec- 
tion of disconnected nodes by the available technical crews; and the automatic 
reconnections made through remote telecontrol operations. These actions are 
needed to restore the EDN and to bring it back to its normal operating condition. 
Upon these actions, all users are supposed to be reconnected to the grid. As previ- 
ously said, damaged SS are just substituted by a PG, and, at the end of the simula- 
tion, they are still in the damaged state although their function is guaranteed by the 
PG. The impact of the perturbation P on the EDN is thus computed using Eq. (3). 


6. Simulation, analysis, and discussion of the results 


In a previous work [19], the EDN of the metropolitan Rome, area (Italy), was 
deeply investigated by extensive calculations enabling to estimate its resilience 
score, according to the definition reported in Section 3. RecSIM has been used to 
study the behavior of the whole EDN of the metropoli-Rome EDN that is a large 
EDN grid composed of 139 PS and 14938 SS distributed along 1607 MV lines. 
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The power grid has 6348 telecontrolled SS (i.e., 42% of the total SS) and 1012 
automated SS (i.e., 6% of the total SS). Considering the MV lines, the power grid 
has 1447 MV lines that contain at least 1 telecontrolled SS (90%) and 510 MV lines 
containing at least 1 automatized SS (31%). The considered power grid is set in the 
so-called normal configuration that is: 


1. A specific topology of the network (consisting of a given number of SS, witha 
given fraction of telecontrolled, automatic, and frontier SS) 


2. With the switches along the medium-voltage lines located in specific points, 


3. The telecontrolling BTS providing services to a certain extent (in our simula- 
tion we consider a default fraction of unavailable BTS leading telecontrolling 
functionality unavailable—apparently a “physiological” conditions of depend- 
ent networks) 


4. A given number of technical crews available in the field for the manual recov- 
ery operations 


5. Standard times for the solution of the different actions to be performed for SS 
restoration 


When referred to “normal configuration,” we will refer to equal (1)—(5) condi- 
tions. The reported simulation has the character of a “stress test.” Two different 
stress schemes have been adopted: the unbiased perturbation scheme and the 
heuristic scheme. 

In the unbiased perturbation scheme, each electrical substation (SS; i = 1, N), 
one at a time, has been set in the damage state and the resulting impact of electrical 
crisis estimated in terms of the r, defined in Eq. (3). Figure 5 reports the distribution 
function D‘) for all resulting r,. This simulation will be referred to as the “(N— 1) 
analysis,” as it involved the set in the damage state of a single SS (at a time). 
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Figure 5. 
D (T) distribution of the resulting impacts as functions of the impacts, for a N — 1 analysis, i.e., in the event of 
one node damaged. 
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The same stress test could be repeated by setting in the damage state two, three, 
or more SS simultaneously, in a way intended to generate crisis situation of higher 
impact (although with a lower probability of occurrence. Each case will produce a 
distribution function of the r values such as D? (r), D? (1), etc. 

The impact distribution p® « functions do provide the generating function for the 
resilience score, which has been associated to its normalized integral Eq. (6): 
the larger the integral of the distribution, the lower the resilience. In fact, for an 
infinitely resilient network, each damage should correspond to the lowest possible 
(or vanishing) impact in the terms expressed by Eq. (3). The overall system resil- 
ience could be estimated as a series of terms each one representing the contribution 
toward resilience for different (and progressively large) perturbations: 


R -aY RY sa? R sa? RO +1. (7) 


While the terms R will be achieved by applying Eq. (6) to the different 
D (T), the terms a” can be related to the probability of the event; this would 
produce a series of progressively smaller terms which will reduce the impact of 
the high order contributions to the total value. The first terms related to (N — 1) 
and (N — 2) events would thus dominate the series in Eq. (7) which will provide 
an unbiased estimate of the global resilience of the network when perturbations 
are imposed following an exhaustive scheme rather than a heuristic method. 

A different perturbation scheme (the heuristic one) has been also applied to 
provide a further possible perturbation scheme aiming to realize a resilience assess- 
ment which, in such case, will be measured by estimating Eq. (6): this will be done 
through the use of a distribution function D” (T) resulting from the application of 
the heuristic perturbation scheme. The heuristic scheme has been thus designed and 
applied to compare the resulting resilience score R” with that obtained through the 
use of the unbiased perturbation scheme. 

Instead of producing systematic damages (as in the unbiased scheme), we have 
produced “educated” damage scenarios where SS have been set in the damaged state 
as a function of their effective rate of faults (as declared by the electrical operator). 
The heuristic perturbation scheme is thus carried out in the following way. Let us 
assume to know the rate of faults per day pI of each SS of the network, expressed in 
terms of the average number of times that the SS have been recorded to be out of 
order. Statistics have been collected along several years and the number of observed 
faults normalized over the number of days of observation. The pr value could 
be thus assimilated to the daily probability that the specific substation goes ina 
damaged state. The cause of SS fault could be different: the SS could be hit by some 
external event (i.e., natural hazard and/or its consequences) or by some internal 
event (i.e., the disruption of some component). The statistical fault rate per com- 
ponent does not distinguish between the origins of fault; we will thus consider this 
fault rate as an “intrinsic” property of the EDN element. 

The heuristic perturbation scheme has been thus applied to the network “normal 
configuration” by simulating M working days: in each day of operations, the dam- 
aged state of each SS has been sampled (as in a Monte Carlo scheme) by extracting 
a random number 7; (r; = [0, 1]) and by comparing it with the p; value: if r; < pi, the 
i-th SS is put in the damaged state where it remains unperturbed elsewhere. The SS 
set in the damage state have been put simultaneously in the damaged state, in order 
to simulate the worst-case scenario. This procedure is repeated n times to scan each 
SS and then repeated M times to simulate different working days. 

This procedure generates very few damages, as the rate of faults of the substations 
is usually particularly small. However, it generates cases where one (or even more than 
one) substation will result in a damaged state. This procedure thus allows to sample 
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Figure 6. 

Comparison of the D(T) distribution values for the N — 1 and N — 2 unbiased scheme simulation resulting 
from the simulation via the heuristic scheme (red = unbiased (N - 2), purple = unbiased (N — 1), and 
black = heuristic scheme). 


(among the manifold of possible damaged network states) those states where one or 
more SS are simultaneously damaged, in agreement with the rate of faults of the dif- 
ferent stations. Over n” = 1515 damaged configurations were obtained with the Monte 
Carlo sampling, of which 1163 were constituted by a single damaged SS; 296 with 2 
damaged SS; 49 with 3 damaged SS; 5 with 4 damaged SS; and 2 with 5 damaged SS. 

Figure 6 summarizes all the results obtained thanks to the simulations by using the 
(N — 1) and the (N — 2) unbiased scheme and the heuristic perturbation scheme. In all 
simulations (both for the unbiased and for the heuristic schemes), the same number of 
technical crews C available for the service restoration has been assumed (C = 2). The 
three curves, however, derive from simulations scheme which have produced differ- 
ent amounts of crisis scenarios whose impacts have been measured through Eq. (3). 

In fact, for the unbiased (IN — 1) simulation, a number of crisis scenarios n equal to 
the number of nodes N have been produced (nN - ? - N = 13,618). In the case of the 
unbiased (N — 2) simulation, a number of crisis scenarios n®™7 ? = 271,581 have been 
produced (this number corresponds to the total number of double faults occurring 
along the same medium tension line). 

For the heuristic perturbation scenario, the number of cases was, in turn, 

n, = 1515 as previously stated. The most relevant feature of the three distributions 
must be observed in the impact dimension. The perturbations produced by using 
an unbiased (N — 2) scheme produce very large effects, as they tend to involve a 
large number of SS, which impose a sequence of interventions (with the provided 
number of technical crews k available, not all SS could be simultaneously repaired). 

The estimate of the corresponding RË, R? , and R™ [through the use of Eq. (6)] 
appropriately renormalized all the distributions. Application of Eq. (6) to the three 
different distribution functions provides the following values: R® = 2.17 x 107°, 

R® = 7.60 x 10”, and R® = 1.78 x 107. 

It is interesting, in turn, to notice that crises produced by the heuristic scheme 
(i.e., involving SS which have shown a large propensity to fault), although in some 
cases involving more than a SS produces impacts which, even in the largest cases, 
are of the same dimension of those produced by worst cases in the (N — 1) unbiased 
simulation. This is probably due to the fact that more vulnerable SS are located 
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along lines, which do not produce relevant outages in case of fault (either for the 
presence of a few not remotely controlled SS and/or for the presence of a not too 
large number of connected customers). 

Different scores are the results of the different adopted simulation schemes. 
Rather than the absolute resilience score, what should be estimated which might 
have a technological meaning are “resilience score variations”: when the same net- 
work (and/or its management properties) is modified, the same simulation scheme 
can be adopted and the resilience score measured again. The difference of the 
resilience score (before and after the modifications) will provide an indication on if 
modifications have (or have not) produced benefits to the overall network resilience. 


7. Conclusions 


The work presented in this chapter that built a great amount of work done on 
the same topic [18, 19] presents the RecSIM system and its relevant capabilities to 
represent and simulate real urban system and in particular problems related to the 
reconfiguration of electric distribution systems following faults. In particular two 
major achievements are highlighted, one related to the possibility to account for a 
number of issues, which have not been appropriately considered in the resilience 
assessment process in the existing literature, and the second concerning the viabil- 
ity of implementing RecSIM (and its scalability) to large, real EDN. In particular 
reference has been made in the paper to the case study of Rome city that has a quite 
large distribution network containing more than 13,500 electrical substations. 

As for the general achievements in the area of the models for estimating resilience 
of EDN, a novel, computable scheme has been identified, on which the RecSIM 
engine, described in the paper, is based on. The RecSIM model considers different 
factors encompassing all the phases of risk management, including the technologi- 
cal properties of the network, the fault management procedures, and the network 
interdependency with the telecontrol network. In many cases of previous works on 
the same topic (recalled in Section 2), the resilience estimates have been done by using 
models which considered just the electrical response of the network, thus disregarding 
the topological and technological features of the network, as well as the management 
skills and procedures, and the external and environmental constraints. The EDN 
management model behind the RecSIM tool, in turn, is able to reconstruct the impact 
of a crisis by considering all the abovementioned factors (recalled in Section 4) which 
play a critical role in determining the overall systemic resilience of the EDN. Moreover, 
the possibility of relating the resilience to the distribution of impacts generated by a 
range of possible perturbations, described in this chapter, provides a further improve- 
ment to the prosed approach. Many different perturbation schemes could be therefore 
investigated, and a resilience score, more suitable for to the user’s requirements, can be 
therefore assessed. Last but not the least, this scheme could also be prone to be modi- 
fied by varying the outage impact metrics. Whereas in this work the outage impact I" 
was assessed in terms of the KPI adopted by the Italian regulatory agency [Eq. (3)], 
it can be expressed by considering further metrics, able to account, for instance, the 
economic losses or the level of wealth reduction caused to the citizens [19]. 

As from the analysis of the data resulting from the case study analyzed, i.e., the 
Rome city EDN, the profile of the impact distribution functions resulting from the 
different simulations made on the basis of the unbiased and the heuristic schemes 
has revealed two main results. 

Firstly, the unbiased (IN — 2) scheme provides the worst-case scenario. The simul- 
taneous damage of two SS residing along the same medium-voltage line, produces 
(as expected) impacts of a significant severity since several other SS are involved. 
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In this case, the model would be able to help the detection of the most impacting 
causes and to validate the possible improvements which could be introduced by 
acting on specific issues (i.e., by increasing the quantity of telecontrolled SS along 
the lines and/or by increasing the number of technical crews available and/or by 
improving the telecontrol strategy). This information would be particularly useful 
for electrical operators for the planning of new activities for enhancing resilience. 

Secondly, the heuristic scheme, where SS are damaged according to their effective 
rate of fault (as measured and reported by the electrical operator), provides a resil- 
ience score which is slightly lower than the one resulting from the (IN — 1) unbiased 
scheme. As previously discussed, this could be the result of the correct management 
of the operators which has “segregated” more vulnerable assets along the lines whose 
disruptions cause less relevant impacts on services. The RecSIM tool, in this respect, 
could be useful for assessing which should be the correct way for further improving 
this score by selecting the substations (among those which have produced the crisis 
scenarios accounted for in the simulations) whose robustness improvement could 
further reduce the impact and thus increase the resilience score. Moreover, the tool 
can be used within more general framework as, for example, the emergency manage- 
ment support tool CIPCast-ES [16] which allows to explore a realistic earthquake 
event occurring in an urban area by predicting disruptions on buildings and critical 
infrastructure and by designing a reliable scenario, accounting for road obstruction 
due to building collapse, to be used to design an efficient contingency plan. 

In conclusion, the RecSIM model, being able to gather into a unique scheme 
several EDN features, can provide a reliable tool for the analysis of large and complex 
infrastructures. This is going to be exploited in Italy through the establishment of a 
competence center for risk analysis and forecast of critical infrastructure called EISAC. 
it (European Infrastructure Simulation and Analysis Centre Italian node [31]) which will 
deliver competences and services to support operators and public authorities commit- 
ted to the protection and the emergency management of critical infrastructure. 
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EDN electrical distribution network 

CI critical infrastructures 

TSO transmission system operator 

DSS decision support system 

PS primary substations 

MV medium-voltage line(s) 

SS secondary substations 

SCADA supervisory control and data acquisition 
tlc telecommunication network components 
BTS base transceiver station 
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N nodes 

L links 

F functioning state function 

P perturbation function 

t time 

T time when the functioning of the system is re-established 

PG power generator 

KPI key performance indicator 

ni number of disconnected customers 

Ti disconnection duration 

T; impact 

R resilience 

D(T) distribution function of all the values 

Q set of secondary substations 

tr; time required to reach a damaged link or node 

mM, time required to perform a manual reconnection action 

PG, time required to install power generator backups 

C number C of technical crews available in the field 

D (T) distribution function for the resulting impacts 

(N-1) analysis performed in the hypothesis of one nonfunctioning node 

a(i) factor related to the probability of a crisis event 

(N-2) analysis performed in the hypothesis of two nonfunctioning nodes 

D(h) (T) distribution function for the resulting impacts for an heuristic 
perturbation scheme 

ri random number 

M M working days 

n number of crisis scenarios 
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